Missing documented workload checks in prowler kubernetes scan output
#7 630 ouverte le 29 avr. 2025
Métriques du dépôt
- Stars
- (8 957 étoiles)
- Métriques de merge PR
- (Merge moyen 9j 17h) (314 PRs mergées en 30 j)
Description
New feature motivation
Hi Prowler team 👋,
According to the official documentation on the Prowler website (Kubernetes Policy Index), there are several valuable workload-level checks listed, such as:
- Ensure liveness probe is configured
- Ensure readiness probe is configured
- Ensure CPU request is set
- Ensure CPU limits are set
- Ensure memory requests are set
- Ensure memory limits are set
- Ensure image tag is set to Fixed – not Latest or Blank
However, when I run prowler kubernetes --list-checks using version v5.5.1, none of these checks appear in the output. Additionally, even after deploying intentionally misconfigured workloads (e.g., missing probes or resource limits), they do not show up in the scan results.
Solution Proposed
These are very important security and reliability best practices, especially for production Kubernetes environments, and it would be great to have them included by default in the scan.
Describe alternatives you've considered
Additional context
Environment:
Prowler version: v5.5.1 Mode: Kubernetes scan running in-cluster Platform: EKS
Would appreciate any clarification, and happy to help test if needed. Thanks for your great work on this project! 🙌